Merge "dsp: q6voice: Check size of payload before access" into audio-drivers.lnx.2.0.c7
diff --git a/asoc/codecs/wcd_cpe_services.c b/asoc/codecs/wcd_cpe_services.c
index fc8242a..e584cf0 100644
--- a/asoc/codecs/wcd_cpe_services.c
+++ b/asoc/codecs/wcd_cpe_services.c
@@ -654,7 +654,7 @@
hdr = CMI_GET_HEADER(payload);
service = CMI_HDR_GET_SERVICE(hdr);
- notif.event = CPE_SVC_CMI_MSG;
+ notif.event = CMI_API_MSG;
notif.result = result;
notif.message = payload;
@@ -1170,7 +1170,7 @@
}
pr_debug("%s: boot complete\n", __func__);
- return CPE_SVC_SUCCESS;
+ return CPE_PROC_SUCCESS;
}
static enum cpe_process_result cpe_process_send_msg(
diff --git a/dsp/q6asm.c b/dsp/q6asm.c
index e415db0..95bb8ed 100644
--- a/dsp/q6asm.c
+++ b/dsp/q6asm.c
@@ -1774,6 +1774,13 @@
return 0;
}
+ if (dir != IN && dir != OUT) {
+ pr_err("%s: Invalid audio port index: %d\n", __func__, dir);
+ if ((session_id > 0 && session_id <= SESSION_MAX))
+ spin_unlock_irqrestore(
+ &(session[session_id].session_lock), flags);
+ return 0;
+ }
port = &ac->port[dir];
switch (data->opcode) {
diff --git a/dsp/q6lsm.c b/dsp/q6lsm.c
index 7511c46..554e866 100644
--- a/dsp/q6lsm.c
+++ b/dsp/q6lsm.c
@@ -294,7 +294,7 @@
pr_debug("%s: Freeing session ID %d\n", __func__, client->session);
spin_lock_irqsave(&lsm_session_lock, flags);
- lsm_session[client->session] = LSM_INVALID_SESSION_ID;
+ lsm_session[client->session] = NULL;
spin_unlock_irqrestore(&lsm_session_lock, flags);
client->session = LSM_INVALID_SESSION_ID;
}